security(audit): 工具级审计元数据不构成企业审计日志——无 actor/认证/审批事件、可篡改、不可检索
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
Research direction
Start by reading AuditMeta in src/tools/policy_domain/audit.rs:63-80 and the transcript overwrite path in src/transcript.rs:46-51 and src/atomic.rs. Inspect the plan approval handlers in src/http/handlers.rs:867-925, then map the missing actor, authentication, approval, integrity, retrieval, and export requirements. Done means the agreed audit model and interfaces cover those events without relying on transcript storage.
Written by the indexing model from the issue text.
Description
场景 gap 单（okguitar 提报）· 优先级 P1 · 依赖：depends-on: #85（未终态时 keeper 自动 hold）
基线 HEAD = 9165b9a0。
Summary
现有 AuditMeta（src/tools/policy_domain/audit.rs:63-80）每工具调用记录 step_id/起止时间/args_hash/副作用分类/退出状态——但没有调用者身份、没有权限判定结果；且它随 transcript 存储，transcript 是整文件覆写（temp+rename，src/transcript.rs:46-51 → src/atomic.rs），非 append-only、无签名/哈希链——文件系统任意写者可改写历史。plan approve/reject 端点连 tracing 日志都没有（src/http/handlers.rs:867-925）；认证失败无审计事件；唯一外送通道是 opt-in OTel tracing（feature-gated），与安全审计事件模型无关。
缺口清单
① actor 维度（谁）；② 认证事件（登录失败/凭据轮换）；③ 管理操作（DELETE 会话/改配置）；④ 审批决策（谁批了哪个 plan）；⑤ append-only + 哈希链防篡改；⑥ 按用户/时间检索 API；⑦ 导出（SIEM 对接）。
影响
数据外带/误删事故后无法回答「谁在何时用哪个 key 让智能体做了什么、谁批的计划」——等保/ISO27001/SOC2 审计直接不过。
建议
独立 append-only 审计流（actor + session + tool + policy 决定 + 审批事件），BLAKE3 哈希链（AuditMeta 已用 BLAKE3，基建现成），提供时间范围/用户检索与导出端点；actor 依赖租户配套单的身份注入。
- Dominant language
- Rust
- Stars
- 4
- Forks
- 0
- Avg merge
- 5h 32m
- Merged PRs (30d)
- 7
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jeffkit/recursive
-
Difficulty 3/5 Half a day Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
jeffkit/recursive#141 · 3 comments ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 66/100
jeffkit/recursive#138 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
jeffkit/recursive#134 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
Maintainers usually reply within 1 day
All issues in jeffkit/recursive
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
rubys/roundhouse#571 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 90/100
fastrevmd-lab/rustmistmcp#161 ·
-
arch-audit refactor
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
SocketDev/socket-patch#1011 ·
Maintainers usually reply within 1 day